CVE-2026-82029

MEDIUM 6.5

Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portal

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH_SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.

CWE	CWE-639 CWE-862
Vendor	invoiceninja
Product	invoiceninja
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for invoiceninja invoiceninja

Be the first to know when new medium vulnerabilities affecting invoiceninja invoiceninja are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

invoiceninja / invoiceninja

0 < 5.13.28

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.28 github.com: https://github.com/invoiceninja/invoiceninja/commit/4895dce820e37b849b34af46548afd8520bb81d1 vulncheck.com: https://www.vulncheck.com/advisories/invoice-ninja-broken-access-control-via-vendor-portal

Credits

Michael Holmquist, HASP Labs